Wireshark Tutorial and Cheat Sheet

A powerful tool in any security practitioners toolkit is WireShark. Having a basic understanding of wireshark usage and filters can be a time saver when you are wanting to quickly look at some “interesting” data on the wires (or wifis). Hopefully this short wireshark tutorial and cheatsheet will help you get started.

Before we get started, for those command line orientated or if you just want to run some wireshark decoding on your headless (no gui) linux server, tshark is the command line version of wireshark that is an excellent alternative.

Wireshark will run on a variety of operating systems, we will touch on Ubuntu Linux, Centos and Windows.

If you are using Ubuntu you are in luck.

#apt-get update
#apt-get install wireshark tshark

If you are using Fedora or CentOS:

#yum install wireshark-gnome

On Windows you are probably familiar with going to the download page, download the executable – and run it to install. You will also be installing (during the install) a packet capture driver to allow the network card to enter promiscous mode.

Looking at the wireshark interface, it is clear that you can quickly browse through the different packets that have been captured, you dive into the packet to see all the details right down to the ASCII text that is sent in the clear on unencrypted text based transactions.

Many beginners fail to recognise an excellent and handy feature – the follow tcp stream option. Select a tcp packet and right click on follow tcp stream. This will show you a summary of that entire stream that has been captured. Doing this you can quickly view the source of entire web pages, emails or IRC chat logs for example. Can make you rethink your use of encrypted protocols seeing it so easily. Especially if you capture some pop3 / telnet / ftp username password combinations.

Wireshark and Tshark Filters Cheat Sheet:

These are pretty self explanatory – enter these expressions into the filter bar or on the command line if using tshark. You can quickly deduce how to filter out the noise and get to the packets you want.

eth.addr == 00:11:11:00:11:15
ip.addr == 192.168.0.5
!(ip.addr == 192.168.0.5)
tcp
udp
!(tcp.port == 53)
tcp.port == 80 || udp.port == 80
http
not arp and not (udp.port == 53)
not (tcp.port == 80) and not (tcp.port == 25) and ip.addr == 192.168.0.5

Interested in how noisy the tools on HackerTarget.com are? Fire up wireshark and run a couple of scans, try Nikto and nmap to start with.

Wireshark
Wireshark Download
Wireshark Manual and User Guide

ThinkPoint Virus Removal Tutorial

ThinkPoint is another release of a professionally-looking rogue antivirus program manufactured by scammers that might have originated from Asia or Russia. The fraudulent application will pretend to perform system scans and will detect the presence of critical viruses. Next, it will offer a solution in the form of an upgrade to the full version of the ThinkPoint program which promises to unlock all the features, but, can eventually do nothing. Many who have been fooled into this kind of online scam have been convinced because they have experienced lots of errors like the slowing down of their computer, features of Windows being disabled and the presence of several pop-ups that never cease to come. This infection should be purged from your system. This tutorial will teach you how to get rid of the ThinkPoint virus from your PC.

ThinkPoint is actually one of those smart viruses that brazenly show as an antivirus interface. It is regarded as a piece of malware or malicious software. Aside from causing severe errors in your computer, it can possibly help the hackers behind it to gain access to personal information stored in your computer. As long as this program is installed on your computer, it will continue to wreak havoc and prompt you to purchase the false upgrade. You need to get rid of the virus to stop the infection from damaging your system and possibly infecting other computers.

How To Remove ThinkPoint From Your PC

The conventional way in removing the ThinkPoint Virus from your system is enumerated in 2 steps. Your first step is to close the ThinkPoint application which also means stopping the virus from running in your system, and then carefully removing the program files of the virus. If you have tried exiting from the application using the normal processes, you might have found out that it is quite difficult to do especially since Task Manager has been disabled by the virus. You need to go reboot and enter Windows using "Safe Mode" or use a process killer program like "rkill" to terminate the processes the virus uses to run properly. Only after successfully disabling the processes of the virus can you start deleting program entries to prevent the infection from returning. The 2-step process can be quite challenging to many PC users.

This virus will install itself here:

C:\Documents and Settings\User\Application Data\hotfix.exe

The most effective method in removing the ThinkPoint Virus with relative ease to the user is by using an "anti-malware" program that can detect the virus entries and has the ability to clean the infection thoroughly. From among the many tools available, our tests show that an application called "Frontline Rogue Remover" is the most effective in stopping the ThinkPoint virus. The application first shows you how to stop the virus, and then completely removes it for good. By using Frontline Rogue Remover, you are also protecting your computer from future malware infection.

Tutorial Working with SQL Profiler

This tutorial complements the article “Tracing ArcSDE Queries with SQL Profiler,” by Shannon Shields and Joseph Buckles which appeared in the January-March 2002 issue of ArcUser … magazine. It provides an introduction to tracing queries with SQL Profiler and using SQL Query Analyzer and will teach you how to create a trace template to capture events passed from ArcMap and ArcSDE to Microsoft SQL Server. You will also learn how toÜ Choose events and data columnsÜ Set filters in SQL ProfilerÜ Evaluate query statements …

SQL Profiler and SQL Query Analyzer are performance monitoring tools that are included with SQL Server. These tools can be used by a database administrator to diagnose problems and optimize performance. This tutorial introduces only a small portion of the functionality available with SQL Profiler and SQL Query Analyzer. More information on both tools can be found in the HTML Help file, SQL Server Books Online, available from the Microsoft Web site (www.microsoft.com/sql/techinfo/ productdoc/2000/). To learn more about administering SQL Server with ArcSDE, enroll in ArcSDE Administration for SQL Server, a five-day instructor-led course offered by ESRI. Visit the ESRI Web site (www.esri.com) for information about this course and other resources. Data for This Tutorial The data for this tutorial, based on a dataset containing land-use parcels for Wilson County, North Carolina, consists of a personal geodatabase feature class containing parcel data. Download the archived data file, Parcels.zip, from the ArcUser Online Web site. Important: After downloading and unzipping Parcels.zip, open the parcels personal geodatabase. Copy or import the parcels feature class into ArcSDE. If you do not have permission to load data into ArcSDE, get your ArcSDE administrator to copy the data and grant you SELECT privileges for the feature class. Tutorial Overview Before beginning this tutorial, verify that the ArcSDE server is running and that your Working with SQL Profiler HTML Help file, SQL Server Books Online, available from the Microsoft Web site provides, information on SQL Profiler and SQL Querry Analyzer login to SQL Server has appropriate permissions to view the data. In this tutorial you will Ü Create a SQL Profiler trace template Ü Connect to ArcSDE from ArcMap Ü Perform an attribute query Ü View the results of the query in SQL Profiler Ü Copy the traced query to SQL Query Analyzer Ü View query statistics Ü Create a column index in ArcCatalog Ü View query statistics using the new index Step 1: Create a SQL Profiler trace template This step defines a new trace definition in SQL Profiler by specifying which events to trace and what type of information to record for each event. A trace template must be created first to store the trace definition. 1. From the Start menu, choose Programs > Microsoft SQL Server > Profiler to start SQL Profiler. 2. From the SQL Profiler menu, choose File > New > Trace Template. 3. Click Save As to save the trace template. 4. Save the Template as tutorial.tdb in the default directory for SQL Server. 5. In the Trace Properties dialog box, click the Events tab. 6. In the Available Event Classes list, expand the Stored Procedures event category by clicking on the plus sign (+) next to it. 7. Select SP:StmtCompleted. 8. Click the Add button to add it to the Selected Event Classes list. 9. Click the Data Columns tab. 10. From the Unselected Data column, add the TextData, Duration, and Reads columns to the Selected data list. 11. Click Save to create the template but do not close SQL Profiler. Step 2: Connect to ArcSDE from ArcMap In this step you will query the Parcels feature class using ArcMap to find Railway right-of-way features. During this step a trace running in SQL Profiler will capture the…….